Hackers drain more than $100m in Bitcoin from ‘cold’ wallets after Coinkite software flaw exposed
Hackers have stolen in excess of $100 million in Bitcoin from thousands of accounts thought to be among the safest in the market, after a software defect in Coinkite Inc’s Coldcard hardware wallets left users’ funds vulnerable.
4th August 2026 – (Toronto) Hackers have stolen in excess of $100 million in Bitcoin from thousands of accounts thought to be among the safest in the market, after a software defect in Coinkite Inc’s Coldcard hardware wallets left users’ funds vulnerable. The Canadian firm warned customers late last week that some devices had been compromised; by Monday, more than 1,755 Bitcoin, worth roughly $110 million, had been drained from around 5,000 wallets, according to Galaxy Research, triggering alarm across social media and among affected investors. Victims reported watching balances vanish within minutes. Jonathan Goodman told Bloomberg that between 9:36pm and 9:43pm on 29 July all three of his wallets were emptied, costing him about $1. 6 million. Others shared similar experiences online, underscoring how a tool designed to keep assets offline and insulated from hacks became the vector for a sweeping theft. Engineers at Block Inc said the breach stemmed from how Coldcard devices generated seed phrases — the strings of words used to recover or access a wallet — due to flawed implementation of the random number generator. In some cases, a fallback mechanism created keys using simpler values such as device serial numbers, rendering the “randomness” predictable. Security specialists said attackers were then able to compute private keys and systematically sweep funds. Coinkite said on its website that funds remain at risk and released updated software after some customers reported being locked out of their devices. The episode has reignited debate over the risks of self-custody. “It’s a reminder that self-custody is only as strong as the processes used to generate and protect private keys,” said Ayesha Kiani, chief operating officer at Monarq Asset Management. Aneirin Flynn, chief executive of cybersecurity firm Failsafe, argued the hack “exposes the fallacy of your crypto being offline,” noting that if the mathematics underpinning key generation fails, passwords can be reverse‑engineered. Bitcoin prices were little changed around $63,800 despite the turbulence. Data from TRM Labs show total crypto theft in the first half of 2026 has fallen to $972 million from $2. 3 billion a year earlier, although the number of incidents rose to 207, a record for any six‑month period — figures that do not include the unfolding Coldcard attack. For many everyday holders, the losses feel particularly bitter given cold wallets’ reputation for safety. Tim Lamb of EquityEdge Studio appealed to authorities on X, saying the two Bitcoin he had saved to give his children “a good start in life” were gone, calling it a “terrible blow”. Goodman said the experience revealed how much “blind faith” he had placed in the technology and that he would no longer invest in Bitcoin or use cold wallets, adding: “If it really is this complicated and technical, perhaps it’s not worth doing. ”